What is not covered by HIPAA?

Information held by non-covered entities, employment records, student education records, and de-identified data are not protected by HIPAA.

HIPAA (the Health Insurance Portability and Accountability Act) only protects Protected Health Information (PHI) when it is created, received, maintained, or transmitted by a covered entity (healthcare providers, health plans, and healthcare clearinghouses) or their business associates.

Information Outside HIPAA Rules

• Consumer Apps and Wearables: Health data entered into fitness trackers, smartwatches, period-tracking apps, or mental wellness platforms is not protected by HIPAA unless the app directly contracts with a healthcare provider or plan.
• Employment Records: Health information kept by an employer in personnel files—such as sick leave notes, FMLA (Family and Medical Leave Act) forms, ADA (Americans with Disabilities Act) accommodation requests, or drug test results—is excluded.
• Education Records: Student health records managed by K-12 schools or universities are governed by FERPA (Family Educational Rights and Privacy Act) instead of HIPAA.
• Publicly Available Information: News reports, court records, or health details you share publicly on social media are not protected.
• De-Identified Data: Health information that has had all personal identifiers (like name, birth date, and contact info) permanently removed is no longer restricted.
• Life and Disability Insurance Records: Data shared with life insurers, disability insurers, or workers' compensation carriers is not covered.

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

• Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
• Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
• Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
• Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
• Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
• Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
• Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
• Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
• Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
• Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

The five primary components or rules that make up HIPAA compliance are the Privacy Rule, Security Rule, Breach Notification Rule, Omnibus Rule, and Enforcement Rule.

1. The Privacy Rule

• Sets national standards for the use and disclosure of Protected Health Information (PHI).
• Gives patients the right to view, obtain copies of, and request corrections to their medical records.
• Limits the sharing of medical data to the "minimum necessary" required for patient care.

2. The Security Rule

• Establishes technical, physical, and administrative safeguards specifically for electronic Protected Health Information (ePHI).
• Requires organizations to control access to computer systems and encrypt digital data.
• Mandates regular risk assessments to find and fix vulnerabilities.

3. The Breach Notification Rule

• Requires covered entities to notify affected individuals, the government (HHS), and sometimes the media following a data breach.
• Mandates notification without unreasonable delay and no later than 60 days after discovering a breach.

4. The Omnibus Rule

• Expands HIPAA and HITECH Act requirements to cover business associates and their subcontractors.
• Strengthens restrictions on using genetic information for health insurance underwriting and updates patient privacy rights.

5. The Enforcement Rule

• Outlines how the Department of Health and Human Services (HHS) investigates compliance complaints.
• Establishes the tiered civil and criminal penalty structures for HIPAA violations.

The three specific exceptions under the HIPAA Breach Notification Rule determine whether an unauthorized acquisition, access, or use of Protected Health Information (PHI) constitutes a reportable breach.

The Three Exceptions to a HIPAA Breach

• Unintentional acquisition, access, or use of PHI: An employee or workforce member accesses PHI unintentionally, in good faith, and within the scope of their authority, without further impermissible disclosure.
• Inadvertent disclosure between authorized persons: A person authorized to access PHI at a covered entity or business associate accidentally discloses that information to another authorized person within the same organization or arrangement, without further impermissible use.
• Good faith belief that the recipient could not retain the information: An unauthorized disclosure where the covered entity or business associate has a good faith belief that the unauthorized person who received the PHI could not have reasonably retained it.

The three primary categories of covered entities under the Health Insurance Portability and Accountability Act (HHS.gov) are healthcare providers, health plans, and healthcare clearinghouses.

As outlined by the Department of Health and Human Services, these groups must protect patient data and comply with HIPAA rules:

1. Healthcare Providers

• Definition: Doctors, clinics, hospitals, psychologists, dentists, chiropractors, nursing homes, and pharmacies.
• Rule for coverage: They are only covered entities if they transmit health information in electronic form for standard transactions (like billing or insurance claims).

2. Health Plans

• Definition: Organizations that pay for or provide medical care.
• Examples: Health insurance companies, HMOs (Health Maintenance Organizations), employer-sponsored group health plans, and government programs like Medicare and Medicaid.

3. Healthcare Clearinghouses

• Definition: Entities that process nonstandard health information into a standard electronic format, or the reverse, acting as middlemen between providers and payers.
• Examples: Billing services, community health management information systems, and value-added networks that reformat data.